Analysis
-
max time kernel
62s -
max time network
93s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-09-2022 15:52
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220812-en
General
-
Target
tmp.exe
-
Size
794KB
-
MD5
9c038c34e4d37410cecb1f20f90984d5
-
SHA1
ad16dea0d1f1d3eb45e8d8e1a040e42110ab1bec
-
SHA256
566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0a27c61bd92f511efe76
-
SHA512
5e5a5b357fe902b76b8c76a534904cc4ab588d9e558c1c5a6ad935326fa532873a27f6b1c9dd6c62aecc84ac791cc2442c9ef41c4151077d7499ed7c7e59b961
-
SSDEEP
6144:gHsV9Ig0yuLxcxxHz9Fl5iD4n3HVxx+BcUg+4oyss3MAy8IfSEA6gsumifLzJ6:4svBPnHJ5iERUghGUMAOSElgsumiT
Malware Config
Extracted
redline
VERIF01
please.c0nnect2me.ru:7777
-
auth_value
2eddda17dd5a8a8c16c28e7fe0f74b6c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1012-55-0x0000000000340000-0x0000000000360000-memory.dmp family_redline -
Executes dropped EXE 1 IoCs
Processes:
tmp6E1F.tmp.exepid process 1224 tmp6E1F.tmp.exe -
Loads dropped DLL 3 IoCs
Processes:
WerFault.exepid process 2032 WerFault.exe 2032 WerFault.exe 2032 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2032 1224 WerFault.exe tmp6E1F.tmp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
tmp.exepid process 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe 1012 tmp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
tmp.exedescription pid process Token: SeDebugPrivilege 1012 tmp.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
tmp.exetmp6E1F.tmp.exedescription pid process target process PID 1012 wrote to memory of 1224 1012 tmp.exe tmp6E1F.tmp.exe PID 1012 wrote to memory of 1224 1012 tmp.exe tmp6E1F.tmp.exe PID 1012 wrote to memory of 1224 1012 tmp.exe tmp6E1F.tmp.exe PID 1012 wrote to memory of 1224 1012 tmp.exe tmp6E1F.tmp.exe PID 1224 wrote to memory of 2032 1224 tmp6E1F.tmp.exe WerFault.exe PID 1224 wrote to memory of 2032 1224 tmp6E1F.tmp.exe WerFault.exe PID 1224 wrote to memory of 2032 1224 tmp6E1F.tmp.exe WerFault.exe PID 1224 wrote to memory of 2032 1224 tmp6E1F.tmp.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp6E1F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6E1F.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 963⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6E1F.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
\Users\Admin\AppData\Local\Temp\tmp6E1F.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
\Users\Admin\AppData\Local\Temp\tmp6E1F.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
\Users\Admin\AppData\Local\Temp\tmp6E1F.tmp.exeFilesize
74KB
MD5cdd3d44d9e64a113618961f0a4e691b9
SHA1a762037bc50ddb7507d5ef1a20ce813ad990bb54
SHA256dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0
SHA51255146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8
-
memory/1012-54-0x0000000000250000-0x000000000031C000-memory.dmpFilesize
816KB
-
memory/1012-55-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/1224-56-0x0000000000000000-mapping.dmp
-
memory/2032-58-0x0000000000000000-mapping.dmp